Zhone 6748-A2 teardown, bootlog and OpenWrt thoughts

Warning, long post full of dumps and logs!

This is one of the varieties of CPEs that Vodafone in Iceland rents out.  It’s just called the “Zhone” box on vodafone.is, and this particular version is no longer provided, but an apparently identical version in a “sexy” case is still available.  They charge 650kr per month for this privilege.  I understand having to have the ISPs hardware for DSL, but we’re on a fibre connection here, so this is only serving as a plain old wireless router.  I finally got around to replacing it with a Xiaomi mini wifi running OpenWrt, which only cost me ~4000kr, so that will pay off fairly quickly.  So, a quick teardown for documentation purposes before returning it.  An internet search for the product name is…. unproductive.  It appears to be a customized version specifically for Vodafone Iceland.  (The full product code on the back is: 6748-A2-EU-0VF-D, and I found other references on line to another zhone cpe, 6219-X1-NA-0CC, for “Consolidated Communications”, presumably in north america?) Anyway. It’s a generally fairly capable device, it’s worked quite well for us, after a firmware update or two. It has VDSL/ADSL2+ support, 2 USB ports, 4 Lan, 1 Wan, 2 RJ11 Phone ports. 16meg flash, 64meg ram.

Board identifies as a Broadcom 96368MVWG, which is an OpenWrt supported reference platform as long as you can get an image loaded onto it. (I bet all the leds are wrong though)

More curiously, one of the board info commands identifies the device as a MitraStar 6748-A1. I wonder if zhone OEM’s their OEM work?

Pics and logs below. I’ve returned this board, I don’t really need any more projects, though it looks to be perfectly capable hardware.

Board top side full

Console wiring and DSL chip

The unused POTS section and wifi on the side

The unused POTS section and wifi on the side

Wifi section

Board back side (flash)

From the bootlog, and some other bits and pieces

raw bootloader attempts

Some bootloader command logs. It seems to have a lot in common with Zyxel bootloaders, despite being called CFE. However, The Zyxel tricks for ATEN and ATSE to get into full mode don’t seem to work, and I couldn’t get ATDU to dump memory either.

CFE> atbl
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 3  
Board Id (0-4)                    : 96368MVWG  
Number of MAC Addresses (1-32)    : 1  
Base MAC Address                  : 00:02:71:30:65:7f  
PSI Size (1-64) KBytes            : 128  
Main Thread Number [0|1]          : 0  

*** command status = 0
CFE>
CFE> atsh

ZLD      Version       : V1.02(VFY.1)b6
Bootbase Version       : V1.18 | 05/10/2011
Vendor Name            : MitraStar Technology Corp.
Product Model          : 6748-A1
Serial Number          : 303171711
First MAC Address      : 00027130657F
Last MAC Address       : 00027130657F
MAC Address Quantity   : 01
Default Country Code   : CD
Boot Module Debug Flag : 00
RootFS      Checksum   : b307d772
Kernel      Checksum   : 8de663dd
Main Feature Bits      : C0
Other Feature Bits     :
	 	5a 59 60 03 00 00 00 33-30 33 31 37 31 37 31 31 
	 	00 00 00 00 00 00 00 00-03 41 13 00 00 00 

*** command status = 0
CFE>

CFE> dd
Invalid command: "dd"
Available commands: 
ATSE, ATEN, ATCR, ATSH, ATUR, ATUW, ATBL, ATDU, ATBR, ATGO, ATSR, ATMB, ATHE

CFE> atuw
Block0 is forbidden to write!

ERROR
*** command status = -1
CFE> atur

--- I thought this was upload _from_ the board, but it wanted to receive a file instead

Starting XMODEM upload (CRC mode)....
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC*** file: blah.bin
rz -vv blah.bin 
rz: garbage on commandline
Try `rz --help' for more information.

*** exit status: 2
CCCCCCCCCC
Thanks for using picocom
karlp@teros:~$ picocom --receive-cmd "rx -vv" -b 115200 /dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0 
picocom v1.7

port is        : /dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rx -vv
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,

Terminal ready

CFE> atur

Starting XMODEM upload (CRC mode)....
CC*** file: blah.bin
rx -vv blah.bin 

rx: ready to receive blah.bin
Retry 0: Got 0103 sector header
Retry 1: Got 0103 sector header
Retry 2: Got 0103 sector header
Retry 3: Got 0103 sector header
Retry 4: Got 0103 sector header
Retry 5: Got 0103 sector header
Retry 6: Got 0103 sector header
Retry 7: Got 0103 sector header
Retry 8: Got 0103 sector header
Retry 9: Got 0103 sector header
Blocks received: -1
rx: blah.bin removed.

Transfer incomplete

*** exit status: 128

Remote cancel, please download again...

ERROR
*** command status = -1
CFE> athe
Available commands:
ATSE                show the seed of password generator
ATEN                set BootExtension Debug Flag
ATCR                Clear console screen
ATSH                dump manufacturer related data in ROM
ATUR                xmodem upload router firmware to flash ROM
ATUW                xmodem upload flash image to flash ROM
ATBL                Print boot line and board parameter info
ATDU                Dump memory or registers.
ATBR                Reset to default Romfile
ATGO                boot router
ATSR                system reboot
ATMB                Use for multiboot.
ATHE                print help

For more information about a command, enter 'help command-name'
*** command status = 0

CFE> atdu 0 100
**Exception 8: EPC=8041AD64, Cause=00000000 (Interrupt)
                RA=00000006, VAddr=32312C20

        0  ($00) = 00000000     AT ($01) = 8042C860
        v0 ($02) = 8040A304     v1 ($03) = 8041035C
        a0 ($04) = 00000000     a1 ($05) = 00000000
        a2 ($06) = 00000001     a3 ($07) = 20696E66
        t0 ($08) = 00000000     t1 ($09) = 80412C90
        t2 ($10) = 8052E93C     t3 ($11) = 8052EB90
        t4 ($12) = 8052E93C     t5 ($13) = 8052EB90
        t6 ($14) = 8041035C     t7 ($15) = 51011501
        s0 ($16) = 00000000     s1 ($17) = 646D2061
        s2 ($18) = 73735F69     s3 ($19) = 78206C65
        s4 ($20) = 5F696E5F     s5 ($21) = 6D616C0A
        s6 ($22) = 80411928     s7 ($23) = 80000000
        t8 ($24) = 80411928     t9 ($25) = 00000000
        k0 ($26) = 00000000     k1 ($27) = 00000000
        gp ($28) = 00000000     sp ($29) = 00000006
        fp ($30) = 00000002     ra ($31) = 00000006

Raw complete enormous bootlog

I’ve “hidden” some plain text ftp passwords that were in the boot log to protect the innocent/guilty, but this is otherwise plain.

CFE version 1.18.0-102.9 for BCM96368 (32bit,SP,BE)
Build Date: 05/10/2011 (eason@msgsw3-i7)
Copyright (C) 2000-2009 Broadcom Corporation.

Parallel flash device: name MX29GL128EH, id 0x2221, size 16384KB
ethsw: found bcm53115! CPU type 0x2A031: 400MHz, Bus: 160MHz,
Ref: 64MHz CPU running TP0 Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000


Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 3  
Board Id (0-4)                    : 96368MVWG  
Number of MAC Addresses (1-32)    : 1  
Base MAC Address                  : 00:02:71:30:65:7f  
PSI Size (1-64) KBytes            : 128  
Main Thread Number [0|1]          : 0  

*** Press any key to stop auto run (3 seconds) ***
Auto run second count down: 0
Checking Reset button on GPIO 34 
Wait for Multiboot Service Packet...  0
Booting from only image (0xb8020000) ...
Code Address: 0x80020000, Entry Address: 0x802e7000
Decompression OK!
Entry at 0x802e7000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x802e7000
Linux version 2.6.21.5 (penelope@CPESW2BS01) (gcc version 4.2.3)
#3 Fri Dec 21 15:15:04 CST 2012 Parallel flash device: name
MX29GL128EH, id 0x2221, size 16384KB 96368MVWG prom init CPU
revision is: 0002a031 Determined physical RAM map:
 memory: 03ece000 @ 00000000 (usable)
On node 0 totalpages: 16078
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 93 pages used for memmap
  Normal zone: 11889 pages, LIFO batch:1
Built 1 zonelists.  Total pages: 15953
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache... Primary instruction
cache 64kB, physically tagged, 4-way, linesize 16 bytes. Primary
data cache 32kB, 2-way, linesize 16 bytes. Synthesized TLB refill
handler (21 instructions). Synthesized TLB load handler fastpath
(33 instructions). Synthesized TLB store handler fastpath (33
instructions). Synthesized TLB modify handler fastpath (32
instructions). PID hash table entries: 256 (order: 8, 1024 bytes)
Using 200.000 MHz high precision timer. Dentry cache hash table
entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table
entries: 4096 (order: 2, 16384 bytes) Allocating memory for DSP
module core and initialization code Allocated DSP module memory -
CORE=0x8108c700 SIZE=1666416, INIT=0x0 SIZE=0 Memory:
58848k/64312k available (2322k kernel code, 5448k reserved, 517k
data, 100k init, 0k highmem) KLOB Pool 1 Initialized: 1048576
bytes <0x80c00000 ... 0x80d00000> Calibrating delay loop...
398.33 BogoMIPS (lpj=199168) Mount-cache hash table entries: 512
NET: Registered protocol family 16 Total Flash size: 16384K with
128 sectors Address is too big. File system address: 0xb8020100
kerSysFlashInit zyxel_ivr usedBlkSize 524288 kerSysFlashInit
userdefcfg usedBlkSize 131072 registering PCI controller with
io_map_base unset SCSI subsystem initialized usbcore: registered
new interface driver usbfs usbcore: registered new interface
driver hub usbcore: registered new device driver usb BLOG v1.0
Initialized NET: Registered protocol family 8 NET: Registered
protocol family 20 Time: MIPS clocksource has been installed.
NET: Registered protocol family 2 IP route cache hash table
entries: 1024 (order: 0, 4096 bytes) TCP established hash table
entries: 2048 (order: 2, 16384 bytes) TCP bind hash table
entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured
(established 2048 bind 2048) TCP reno registered squashfs:
version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA
suppport for slax.org by jro fuse init (API version 7.8) io
scheduler noop registered (default) PPP generic driver version
2.4.2 NET: Registered protocol family 24 bcm963xx_mtd driver v1.0
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting
latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0:
EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus
registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: irq 15,
io mem 0x10001500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI
1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1
choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI)
Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI:
Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd
0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB
bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq
13, io mem 0x10001600 usb usb2: configuration #1 chosen from 1
choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver... usbcore: registered new
interface driver usb-storage USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered
for GSM modem (1-port) usbcore: registered new interface driver
option drivers/usb/serial/option.c: USB Driver for GSM modems:
v0.7.1 brcmboard: brcm_board_init entry kerSysScreenPciDevices:
0x14e4:0xa8d6:(slot 1) detected kerSysScreenPciDevices:
0x14e4:0x6300:(slot 9) detected kerSysScreenPciDevices:
0x14e4:0x6300:(slot 10) detected SES: Button Interrupt 0x1 is
enabled SES: LED GPIO 0x8018 is enabled Serial: BCM63XX driver
$Revision: 3.00 $ ttyS0 at MMIO 0xb0000100 (irq = 10) is a
BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 11) is a BCM63XX
bcmxtmrt: Broadcom BCM6368B2 ATM/PTM Network Device v0.1 Dec 21
2012 14:59:47 Mirror/redirect action on u32 classifier
    input device check on 
    Actions configured 
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with
*BSD API NET: Registered protocol family 17 NET: Registered
protocol family 15 Ebtables v2.0 registered 802.1Q VLAN Support
v1.8 Ben Greear  All bugs added by David
S. Miller  VFS: Mounted root (squashfs
filesystem) readonly. Freeing unused kernel memory: 100k freed
init started: BusyBox v1.00 (2012.12.21-07:03+0000) multi-call
binary mkdir: Cannot create directory `/tmp': File exists cp:
/etc/ppp/chat/*: No such file or directory cp: /etc/tls/*: No
such file or di

BusyBox v1.00 (2012.12.21-07:03+0000) Built-in shell (msh) Enter
'help' for a list of built-in commands.


Loading drivers and kernel modules... 

pktflow: module license 'Proprietary' taints kernel.
Broadcom Packet Flow Cache learning via BLOG enabled.
Created Proc FS /procfs/fcache
Constructed Broadcom Packet Flow Cache v0.1 Aug 17 2009 11:57:43
Broadcom Packet CMF (Experimental) Char Driver v0.1 Jun 30 2009
11:30:40 Registered<232> Broadcom Packet CMF (Experimental)
[6368-B2] v0.1 Jun 30 2009 11:30:40 Loaded bcmxtmcfg:
bcmxtmcfg_init entry adsl: adsl_init entry IPv6: add_dev failed
for dsl0 Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6368B2
Ethernet Network Device v0.1 Dec 21 2012 14:59:09 KLOB extended
to 2 pools KLOB extended to 3 pools KLOB extended to 4 pools KLOB
extended to 5 pools Config Switch Through SPI Slave Select 0
ethsw: found bcm53115! dgasp: kerSysRegisterDyingGaspHandler:
bcmsw registered Broadcom Packet CMF (Experimental) SWC RESET.
Broadcom Packet CMF (Experimental) SWC INITIALIZED. KLOB extended
to 6 pools KLOB extended to 7 pools KLOB extended to 8 pools
IPv6: add_dev failed for pktcmf_sw_sar Broadcom Packet CMF
(Experimental) Forwarder Net Device 0 v0.1 Jun 30 2009 11:30:40
Registered IPv6: add_dev failed for pktcmf_sar_sw Broadcom Packet
CMF (Experimental) Forwarder Net Device 1 v0.1 Jun 30 2009
11:30:40 Registered Broadcom Packet CMF (Experimental) ENABLED.
eth3: MAC Address: 00:02:71:30:65:7F eth2: MAC Address:
00:02:71:30:65:7F eth1: MAC Address: 00:02:71:30:65:7F eth0: MAC
Address: 00:02:71:30:65:7F eth4: MAC Address: 2A:02:71:30:65:7F
PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting
latency timer of device 0000:00:01.0 to 64 wl: srom not detected,
using main memory mapped srom info (wombo board) wl0: wlc_attach:
MAC addr from system pool. id:0x776c0000 wl0: MAC Address:
22:02:71:30:65:7F wl0: Broadcom BCMa8d6 802.11 Wireless
Controller 5.10.85.0.cpe4.402.8 dgasp:
kerSysRegisterDyingGaspHandler: wl0 registered DSP Driver: DSP
init stub Endpoint: endpoint_init entry Endpoint: endpoint_init
COMPLETED p8021ag: p8021ag_init entry 194 main, getpid = 197,
AppRegisterSignal AppRegisterSignal, mm pid = 197 MM
vendoerOSInit BOS: Enter bosInit bosTimerInit Enter bosAppInit
Exit bosAppInit BOS: Exit bosInit MM UITimer_Init MM rtpInit
UITimerProc [200] started RegisterSignal AppRegisterSignal, mm
pid = 200 Enter TaskCreate rtp TaskCreate - spawn new task rtp
Exit TaskCreate Enter TaskCreate rtcp TaskCreate - spawn new task
rtcp Exit TaskCreate rtpTask, getpid = 201, AppRegisterSignal
AppRegisterSignal, mm pid = 201 rtcpTask, getpid = 202,
AppRegisterSignal AppRegisterSignal, mm pid = 202 203

===== Release Version 4.02L.03 (build timestamp 121221_1515) =====

icf_port_open_ipc_channel path = /var/iptk_es.chanl
the open channel succeded 
exit from the es init 
[MRM]: Exitting function  with SUCCESS
[MRM]: Entering function 
ssk:error:19.696:lck_checkBeforeEntry:175:lock required during
cmsObj_getNextInSubTreeFlags
ssk:error:19.696:mdm_adjustForVoiceHardware:83:mdm_adjustForVoiceHardware:
maxPhysEndpt 2, maxVoipEndpt 0, numFxoEndpt 0, maxCodecs 18

ssk:error:19.840:rcl_loginCfgObject:228:write smb.passwd
===========Insert IP modules=========== ip_tables: (C) 2000-2006
Netfilter Core Team Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (518 buckets, 4144 max)
ssk:error:21.077:NfModuleFn:644:insmod ipt_connlimit.ko FAILED in
insertModule()

ssk:error:21.141:NfModuleFn:644:insmod xt_ether.ko FAILED in
insertModule()

ip6_tables: (C) 2000-2006 Netfilter Core Team
getsockopt failed strangely: No such file or directory
ssk:error:28.156:rutLan_addInterfaceToBridge:729:Add interface to
bridge, atm2 interface atm2 does not exist! interface atm2 does
not exist! SIOCGIFFLAGS: No such device SIOCGIFFLAGS: No such
device [Jan 01 00:00:28] radvd: ioctl(SIOCGIFFLAGS) failed for
br0: No such device [Jan 01 00:00:28] radvd: interface br0 does
not exist [Jan 01 00:00:28] radvd: error parsing or activating
the config file: /var/radvd.conf [Jan 01 00:00:28] radvd:
ioctl(SIOCGIFFLAGS) failed for br0: No such device [Jan 01
00:00:28] radvd: interface br0 does not exist [Jan 01 00:00:28]
radvd: error parsing or activating the config file:
/var/radvd.conf SIOCGIFFLAGS: No such device
ssk:error:28.815:rutLan_addInterfaceToBridge:729:Add interface to
bridge, ptm0.44 interface ptm0.44 does not exist! interface
ptm0.44 does not exist! SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device [Jan 01 00:00:28] radvd:
ioctl(SIOCGIFFLAGS) failed for br0: No such device [Jan 01
00:00:28] radvd: interface br0 does not exist [Jan 01 00:00:28]
radvd: error parsing or activating the config file:
/var/radvd.conf [Jan 01 00:00:28] radvd: ioctl(SIOCGIFFLAGS)
failed for br0: No such device [Jan 01 00:00:28] radvd: interface
br0 does not exist [Jan 01 00:00:28] radvd: error parsing or
activating the config file: /var/radvd.conf SIOCGIFFLAGS: No such
device
dhcpd:error:29.051:set_iface_config_defaults:614:SIOCGIFADDR
failed on br0! smd:error:29.052:oal_processEvents:841:detected
exit of dhcpd (pid=794) on fd 8
ssk:error:29.392:rutLan_addInterfaceToBridge:729:Add interface to
bridge, eth4.44 interface eth4.44 does not exist! interface
eth4.44 does not exist! SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device [Jan 01 00:00:29] radvd:
ioctl(SIOCGIFFLAGS) failed for br0: No such device [Jan 01
00:00:29] radvd: interface br0 does not exist [Jan 01 00:00:29]
radvd: error parsing or activating the config file:
/var/radvd.conf [Jan 01 00:00:29] radvd: ioctl(SIOCGIFFLAGS)
failed for br0: No such device [Jan 01 00:00:29] radvd: interface
br0 does not exist [Jan 01 00:00:29] radvd: error parsing or
activating the config file: /var/radvd.conf SIOCGIFFLAGS: No such
device ssk:error:31.485:rcl_lanIpIntfObject:349:start enable
trunking interfaces
ssk:error:31.485:rcl_lanIpIntfObject:351:bridge 0

ssk:error:31.485:rutPmap_enableTrunkingIntf:784:bridgeRef = 0

ssk:error:31.578:rutLan_addInterfaceToBridge:729:Add interface to
bridge, eth0.0 device eth0.0 is not a slave of br0 device eth0.0
entered promiscuous mode eth0.0: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode eth0.0: add
33:33:00:00:00:01 mcast address to master interface eth0.0: add
01:00:5e:00:00:01 mcast address to master interface eth0.0: add
33:33:ff:30:65:7f mcast address to master interface br0: port
1(eth0.0) entering learning state br0: topology change detected,
propagating br0: port 1(eth0.0) entering forwarding state eth0.0:
del 33:33:ff:30:65:7f mcast address from master interface eth0.0:
del 33:33:00:00:00:01 mcast address from master interface
ssk:error:32.173:rutLan_addInterfaceToBridge:729:Add interface to
bridge, eth1.0 device eth1.0 is not a slave of br0 device eth1.0
entered promiscuous mode br0: port 1(eth0.0) entering disabled
state br0: port 1(eth0.0) entering learning state br0: topology
change detected, propagating br0: port 1(eth0.0) entering
forwarding state eth1.0: dev_set_promiscuity(master, 1) device
eth1 entered promiscuous mode eth1.0: add 33:33:00:00:00:01 mcast
address to master interface eth1.0: add 01:00:5e:00:00:01 mcast
address to master interface eth1.0: add 33:33:ff:30:65:7f mcast
address to master interface br0: port 2(eth1.0) entering learning
state br0: topology change detected, propagating br0: port
2(eth1.0) entering forwarding state eth1.0: del 33:33:ff:30:65:7f
mcast address from master interface eth1.0: del 33:33:00:00:00:01
mcast address from master interface
ssk:error:32.623:rutLan_addInterfaceToBridge:729:Add interface to
bridge, eth2.0 ADDRCONF(NETDEV_CHANGE): eth1.0: link becomes
ready eth1.0: add 33:33:00:00:00:01 mcast address to master
interface eth1.0: add 33:33:ff:30:65:7f mcast address to master
interface device eth2.0 is not a slave of br0 device eth2.0
entered promiscuous mode br0: port 2(eth1.0) entering disabled
state br0: port 1(eth0.0) entering disabled state br0: port
2(eth1.0) entering learning state br0: port 1(eth0.0) entering
learning state br0: topology change detected, propagating br0:
port 2(eth1.0) entering forwarding state br0: topology change
detected, propagating br0: port 1(eth0.0) entering forwarding
state eth2.0: dev_set_promiscuity(master, 1) device eth2 entered
promiscuous mode eth2.0: add 33:33:00:00:00:01 mcast address to
master interface eth2.0: add 01:00:5e:00:00:01 mcast address to
master interface eth2.0: add 33:33:ff:30:65:7f mcast address to
master interface br0: port 3(eth2.0) entering learning state br0:
topology change detected, propagating br0: port 3(eth2.0)
entering forwarding state eth2.0: del 33:33:ff:30:65:7f mcast
address from master interface eth2.0: del 33:33:00:00:00:01 mcast
address from master interface WLmngr Daemon is running optarg=0
shmId=0 ssk:error:33.138:rutLan_addInterfaceToBridge:729:Add
interface to bridge, wl0 device wl0 is not a slave of br0 device
wl0 entered promiscuous mode br0: port 4(wl0) entering learning
state br0: topology change detected, propagating br0: port 4(wl0)
entering forwarding state br0: port 4(wl0) entering disabled
state br0: port 3(eth2.0) entering disabled state br0: port
2(eth1.0) entering disabled state br0: port 1(eth0.0) entering
disabled state br0: port 4(wl0) entering learning state br0: port
3(eth2.0) entering learning state br0: port 2(eth1.0) entering
learning state br0: port 1(eth0.0) entering learning state br0:
topology change detected, propagating br0: port 4(wl0) entering
forwarding state br0: topology change detected, propagating br0:
port 3(eth2.0) entering forwarding state br0: topology change
detected, propagating br0: port 2(eth1.0) entering forwarding
state br0: topology change detected, propagating br0: port
1(eth0.0) entering forwarding state
ssk:error:33.674:rcl_lanIpIntfObject:349:start enable trunking
interfaces ssk:error:33.674:rcl_lanIpIntfObject:351:bridge 1

ssk:error:33.675:rutPmap_enableTrunkingIntf:784:bridgeRef = 1

ssk:error:33.803:rutLan_addInterfaceToBridge:729:Add interface to
bridge, eth3.0 device eth3.0 is not a slave of br1 device eth3.0
entered promiscuous mode eth3.0: dev_set_promiscuity(master, 1)
device eth3 entered promiscuous mode eth3.0: add
33:33:00:00:00:01 mcast address to master interface eth3.0: add
01:00:5e:00:00:01 mcast address to master interface eth3.0: add
33:33:ff:30:65:7f mcast address to master interface br1: port
1(eth3.0) entering learning state br1: topology change detected,
propagating br1: port 1(eth3.0) entering forwarding state eth3.0:
del 33:33:ff:30:65:7f mcast address from master interface eth3.0:
del 33:33:00:00:00:01 mcast address from master interface eth1.0:
add 33:33:ff:00:00:00 mcast address to master interface
BcmAdsl_Initialize=0xC00ACC58, g_pFnNotifyCallback=0xC00E3944
Clocks for QPROC and AFE are being aligned with step through ...
AFE is aligned, i = 050, PhaseValue = -058, PhaseCntl =
0x7FCF0000 QPROC is aligned, i = 051, PhaseValue = -050,
PhaseCntl = 0x7FCF3FCD Clocks for QPROC and AFE are aligned with
syn_status AFE = 0x78, QPROC = 0x70 AFE phase control reg
@0xb0f570f8 default actual = 0x0021C38F, exp = 0x0021c38f QPRC
phase control reg @0xb0f5f0c0 default actual = 0x0421C38F, exp =
0x0421c38f pSdramPHY=0xA3FFFFF8, 0x55555555 0x55555555
*** XfaceOffset: 0x5FF90 => 0x5FF90 ***
*** PhySdramSize got adjusted: 0xD7650 => 0x10DD50 ***
AdslCoreSharedMemInit: shareMemSize=148109(148112)
AdslCoreHwReset:  pLocSbSta=82040000 bkupThreshold=3072
AdslCoreHwReset:  AdslOemDataAddr = 0xA3F99CC4
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered 
bcmxtmrt: MAC address: 2a 02 71 30 65 7f
bcmxtmrt: MAC address: 2a 02 71 30 65 7f
bcmxtmrt: MAC address: 2a 02 71 30 65 7f
bcmxtmrt: MAC address: 2a 02 71 30 65 7f
bcmxtmrt: MAC address: 2a 02 71 30 65 7f
ptm0.44: add 33:33:00:00:00:01 mcast address to master interface
ptm0.44: add 01:00:5e:00:00:01 mcast address to master interface
ptm0.44: add 33:33:ff:30:65:7f mcast address to master interface
ptm0.42: add 33:33:00:00:00:01 mcast address to master interface
ptm0.42: add 01:00:5e:00:00:01 mcast address to master interface
ptm0.42: add 33:33:ff:30:65:7f mcast address to master interface
Could not get lock! wlmngr_retrieve() failed! ptm0.0: add
33:33:00:00:00:01 mcast address to master interface ptm0.0: add
01:00:5e:00:00:01 mcast address to master interface ptm0.0: add
33:33:ff:30:65:7f mcast address to master interface
ssk:error:37.595:rutCfg_getWanPppConnectionInfo:279: Now PPP is
TTY mode! eth4.0: add 33:33:00:00:00:01 mcast address to master
interface eth4.0: add 01:00:5e:00:00:01 mcast address to master
interface eth4.0: add 33:33:ff:30:65:7f mcast address to master
interface ptm0.44: add 33:33:ff:00:00:00 mcast address to master
interface eth4.44: add 33:33:00:00:00:01 mcast address to master
interface eth4.44: add 01:00:5e:00:00:01 mcast address to master
interface eth4.44: add 33:33:ff:30:65:7f mcast address to master
interface eth4.42: add 33:33:00:00:00:01 mcast address to master
interface eth4.42: add 01:00:5e:00:00:01 mcast address to master
interface eth4.42: add 33:33:ff:30:65:7f mcast address to master
interface
ssk:error:38.939:rut_fileSharingCfgUpdate:704:entering...
ptm0.42: add 33:33:ff:00:00:00 mcast address to master interface
eth4.0: add 33:33:ff:00:00:00 mcast address to master interface
fail to read /var/dnsmasq/dnsgw ptm0.0: add 33:33:ff:00:00:00
mcast address to master interface fail to read /var/dnsmasq/dnsgw
==== Dump of CMS AutoProvision Config====
Enable = 1
autoProvServerUrl = ftp://xxxxxx:yyyyyy@bad.domain.name
autoProvPeriodicInterval = 1440
autoProvRetryInterval = 2
autoProvRetryMaxInterval = 10
set loglevel to Error
wlctl -i wl0 phytype > /var/wl0
wlctl -i wl0 phytype > /var/wl0
wlctl -i wl0 revinfo > /var/wl0
wlctl -i wl0 bands > /var/wl0bands
wlctl ver > /var/wlver
wlctl -i wl0 cap > /var/wl0cap
device wl0 left promiscuous mode
br0: port 4(wl0) entering disabled state
eth4.42: add 33:33:ff:00:00:00 mcast address to master interface
eth4.44: add 33:33:ff:00:00:00 mcast address to master interface
WLMNGR-DAEMON:error:39.792:rutLan_addInterfaceToBridge:729:Add
interface to bridge, wl0 device wl0 is not a slave of br0 device
wl0 entered promiscuous mode br0: port 4(wl0) entering learning
state br0: topology change detected, propagating br0: port 4(wl0)
entering forwarding state br0: port 4(wl0) entering disabled
state br0: port 3(eth2.0) entering disabled state br0: port
2(eth1.0) entering disabled state br0: port 1(eth0.0) entering
disabled state br0: port 4(wl0) entering learning state br0: port
3(eth2.0) entering learning state br0: port 2(eth1.0) entering
learning state br0: port 1(eth0.0) entering learning state br0:
topology change detected, propagating br0: port 4(wl0) entering
forwarding state br0: topology change detected, propagating br0:
port 3(eth2.0) entering forwarding state br0: topology change
detected, propagating br0: port 2(eth1.0) entering forwarding
state br0: topology change detected, propagating br0: port
1(eth0.0) entering forwarding state
smd:error:45.798:initLoggingFromConfig:705:failed to get lock,
ret=9809 atm0: no IPv6 routers present Starting celld
daemon...... celld: invalid option -- m voiceApp[2174] for config
sys started RegisterSignal atm1: no IPv6 routers present
AppRegisterSignal, voiceApp pid = 2174 BOS: Enter bosInit
bosTimerInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit
UITimerProc [2178] started RegisterSignal AppRegisterSignal,
voiceApp pid = 2178 watchdog: invalid option -- m Enter user
spaceRTNETLINK answers: No such device or address
zyims:error:46.774:registerInterestInEvent:109:REGISTER_EVENT_INTEREST
succeeded, msgType = 268436096 interface wl0.1 does not exist!
interface wl0.2 does not exist! atm4: no IPv6 routers present
interface wl0.3 does not exist! atm2: no IPv6 routers present
ptm0.44: no IPv6 routers present softwareVersion = 1.02(VFY.1)b6
==== autoProvStart Parameters====
AutoProvActive = 1
AutoProvServerUrl = ftp://xxxxxxx:yyyyyy@bad.domain.name
AutoProvPeriodicInterval = 1440
AutoProvRetryInterval = 2
AutoProvRetryMaxInterval = 10
SoftwareVersion = 1.02(VFY.1)b6
ssk:error:47.519:initVodslBoundIpIfMultiWanSideUpLocked:594:Failed
to get WAN Connection object
autoProv:error:47.599:autoProvStart:624:2A027130657F,
auto-provision cmsGetMacAddress ptm0: no IPv6 routers present rm:
cannot remove `/var/2A027130657F.cfg': No such file or directory
wget: zhone.c.is: Unknown host
autoProv:error:47.977:autoProvStart:651:autoProvStart, error,
empty file /var/2A027130657F.cfg

ptm0.42: no IPv6 routers present
eth4.0: no IPv6 routers present
dspReinitNeeded,  > IC
zyims:error:48.163:lck_checkBeforeEntry:175:lock required during
cmsObj_getNextInSubTreeFlags phonePortInit NumOfPhyIntf = 2,
NumOfFxo = 0 eBOS: Enter bosInit ntering voiceDspEnter bosAppInit
Init Exit bosAppInit BOS: Exit bosInit endpoint_open COMPLETED
BroadcomPhoneInitEnter bosStartApp
 ::START~~~~~~


bosAppRootTask() - Is it morning already? Spawning app task
(epoch #0)...

Initializing endExit bosStartApp
point with countAppResetDetectionEnable() - Enabled reset
detection. ry code 26 ,vrgEndptInitCfg.currentPowerSource=0
EndpointPacketTask, AppRegisterSignal getpid = 2568
AppRegisterSignal, mm pid = 2568 00:00:48 Endpoint Packet task
started with pid 2568 ...

celld.c-init_3g_dev()-3208:Fail to open
vendor_fdssk:error:48.212:main:318: WAN interface type is "Mixed
Mode"


ptm0.0: no IPv6 routers present
mdio_write skfd = 3, phy_id = 0, reg = 0, val = 0x1140
mii register 0 is 0x1140
eth4: no IPv6 routers present
br0: port 4(wl0) entering disabled state
InValid Device Pin in CFE
WPS Device PIN = 11174066
wlctl -i wl0 phy_watchdog 0
wlctl -i wl0 wds none
wlctl -i wl0 up
wlctl -i wl0 down
wlctl -i wl0 mbss 1
wlctl -i wl0 bss -C 0 down
wlctl -i wl0 bss -C 1 down
wlctl -i wl0 bss -C 2 down
wlctl -i wl0 bss -C 3 down
wlctl -i wl0 ssid -C 0 't''w''e''a''k'
Setting SSID "tweak"
wlctl -i wl0 ssid -C 1 'G''u''e''s''t''1'
Setting SSID "Guest1"
wlctl -i wl0 ssid -C 2 'G''u''e''s''t''2'
Setting SSID "Guest2"
wlctl -i wl0 ssid -C 3 'G''u''e''s''t''3'
Setting SSID "Guest3"
wlctl -i wl0 cur_etheraddr 22:02:71:30:65:7F 2>/dev/null wlctl -i
wl0.1 cur_etheraddr ea:02:71:30:65:7c 2>/dev/null wlctl -i wl0.2
cur_etheraddr ea:02:71:30:65:7d 2>eth4.42: no IPv6 routers
present /dev/null wlctl -i wl0.3 cur_etheraddr ea:02:71:30:65:7e
2>/dev/null wlctl -i wl0 ap 1 wlctl -i wl0 infra 1 wlctl -i wl0
closed 0 wlctl -i wl0 country IS wlctl -i wl0 band b wlctl -i wl0
regulatory 0 wlctl -i wl0 radar 0 2>/dev/null wlctl -i wl0 spect
0 2>/dev/null wlctl -i wl0 nmode -1 wlctl -i wl0 mimo_bw_cap 1
wlctl -i wl0 chanspec -c 11 -b 2 -w 40 -s -1 Chanspec set to
0x2d0b wlctl -i wl0 wpa_cap -C 0 > /var/wpa_cap0 wlctl -i wl0
wpa_cap -C 0 0 2>/dev/null wlctl -i wl0 wpa_cap -C 1 >
/var/wpa_cap0 wlctl -i wl0 wpa_cap -C 1 0 2>/eth4.44: no IPv6
routers present dev/null wlctl -i wl0 wpa_cap -C 2 >
/var/wpa_cap0 wlctl -i wl0 wpa_cap -C 2 0 2>/dev/null wlctl -i
wl0 wpa_cap -C 3 > /var/wpa_cap0 wlctl: Unsupported wlctl -i wl0
wpa_cap -C 3 0 2>/dev/null wlctl -i wl0 maxassoc 16 wlctl -i wl0
bss_maxassoc 16 wlctl -i wl0 gmode Auto wlctl -i wl0
gmode_protection_override -1 wlctl -i wl0
gmode_protection_control 2 wlctl -i wl0 nmode_protection_override
- -1 wlctl -i wl0 protection_control 2 wlctl -i wl0 nreqd 0 wlctl
- -i wl0 wme 0 2>/dev/null wlctl -i wl0 afterburner_override 0
2>/dev/null wlctl -i wl0 ampdu 1 wlctl -i wl0 amsdu 1 wlctl -i
wl0 afterburner_override 0 wlctl -i wl0 wme 1 2>/dev/null wlctl
- -i wl0 wme_noack 0 2>/dev/null wlctl -i wl0 wme_apsd 1
2>/dev/null wlctl -i wl0 wme_bss_disable 0 wlctl -i wl0 rate 0
wlctl -i wl0 bg_rate 0 wlctl -i wl0 leddc 0 2>/dev/null wlctl -i
wl0 bg_mrate 18.0 wlctl -i wl0 rateset default wlctl -i wl0
rtsthresh 2347 wlctl -i wl0 fragthresh 2346 wlctl -i wl0 dtim 1
wlctl -i wl0 bi 100 wlctl -i wl0 frameburst 1 wlctl -i wl0
ap_isolate 0 wlctl -i wl0 pwr_percent 100 wlctl -i wl0
wmf_bss_enable 1 wlctl -i wl0.1 wmf_bss_enable 0 wlctl -i wl0.2
wmf_bss_enable 0 wlctl -i wl0.3 wmf_bss_enable 0 wlctl -i wl0 mac
none wlctPCM: Interrupt Masks l -i wl0 macmode---------------
 0
wlctl -i wl0IrqMask                    = 0x0000070D 
 up
wlctl -i wlIrqMask1                   = 0x00000000 
PCM_IUDMA->ctrl[0].intMask = 0x00000000 

wlctl -i wl0 chPCM_IUDMA->ctrl[1].intMask = 0x00000000 
anspec > /var/cu
PCM: Interrupt Status
rchaspec0
- -----------------
IrqStatus                  = 0x002060B4 
IrqStatus1                 = 0x00000000 
PCM_IUDMA->ctrl[0].intStat = 0x00000000 
PCM_IUDMA->ctrl[1].intStat = 0x00000000 
PCM->pcm_pll_ctrl1         = 0xFC80287D 
PCM->pcm_pll_ctrl2         = 0xD0000000 
PCM->pcm_pll_ctrl3         = 0x380005C0 
PCM->pcm_pll_ctrl4         = 0x00000000 
PCM->pcm_int_pending       = 0x00000000 
PCM->pcm_int_mask          = 0x00000000 
PCM->pcm_ctrl              = 0x00000000 
PCM->pcm_chan_ctrl         = 0x00000000 
PCM_IUDMA->regs.ctrlConfig = 0x00000001 
PCM_IUDMA->ctrl[0].maxBurst = 0x00000008
PCM_IUDMA->ctrl[0].config = 0x00000000
PCM_IUDMA->stram[0].baseDescPointer = 0x2C604243
PCM_IUDMA->stram[0].stateBytesDoneRingOffset = 0xA1EF6C01
PCM_IUDMA->stram[0].flagsLengthStatus = 0x9103EFE2
PCM_IUDMA->stram[0].currentBufferPointer = 0xA1475F32
PCM_IUDMA->ctrl[1].maxBurst = 0x00000008
PCM_IUDMA->ctrl[1].config = 0x00000000
PCM_IUDMA->stram[1].baseDescPointer = 0x2653ACAA
PCM_IUDMA->stram[1].stateBytesDoneRingOffset = 0x03541527
PCM_IUDMA->stram[1].flagsLengthStatus = 0x60CF8124
PCM_IUDMA->stram[1].currentBufferPointer = 0x28C021E0 PLL init
completed. PLL registers set to: PCM->pcm_pll_ctrl1 = 0x0080147D
PCM->pcm_pll_ctrl2 = 0x10000000 PCM->pcm_pll_ctrl3 = 0x38000700
PCM->pcm_pll_ctrl4 = 0x00000015 Set up PCM registers
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x80000000

Channel 0 assigned to timeslot 0
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x89000000

Channel 1 assigned to timeslot 1
XDRV:pcm6368_timeslotAlloc 0xB0004040: 0x89A00000

Channel 2 assigned to timeslot 2
rxDescriptorArea       = 24 
txDescriptorArea       = 24 
Unaligned dmaRxDesc_c  = 0xA02E7000 
Unaligned dmaTxDesc_c  = 0xA032D000 
rxBufferArea          = 1312 
txBufferArea          = 1312 
Unaligned dmaRxData   = 0xA032E000 
Unaligned dmaTxData   = 0xA032F000 
Aligned Tx Desc (0xA032D000): chan 0, buf 0, sts 0xe000, len 640,
bufp 0x32f000 Aligned Tx Desc (0xA032D008): chan 0, buf 1, sts
0x7000, len 640, bufp 0x32f290 Aligned Rx Desc (0xA02E7000): chan
0, buf 0, sts 0x8000, len 640, bufp 0x32e000 Aligned Rx Desc
(0xA02E7008): chan 0, buf 1, sts 0x9000, len 640, bufp 0x32e290
initIudma: chan 0, descBase 0xa02e7000, descBaseIudma 0x2e7000
initIudma: chan 1, descBase 0xa032d000, descBaseIudma 0x32d000
br0: port 4(wl0) entering learning state br0: topology change
detected, propagating br0: port 4(wl0) entering forwarding state
Enter TaskCreate CMT_EXCEPTION_IST TaskCreate - spawn new task
CMT_EXCEPTION_IST Exit TaskCreate regStatus (reg 12 sel 0) =
0x10008501 regStatus (reg 12 sel 7) = 0x00000101 regCause (reg 13
sel 0) = 0x00000000 regCause (reg 13 sel 7) = 0x00808000 regCMT
(reg 22 sel 0) = 0xe31e1406 regCMT (reg 22 sel 1) = 0x10008001
XDRV:Kicking off secondary thread processor at entry point
0x8108C740 ...

XDRV:Secondary thread processor entry point at 0x8108c740

*** DSP TP: Entered main() ***
XDRV:Thread processor handshake. Secondary app initialized
properly.

Enter TaskCreate HTSK
TaskCreate - spawn new task HTSK
Exit TaskCreate 
INFO: MSPI POLLING MODE
INFO: IRQ MASK 0x0000000180308C81
INFO: IRQ STATUS 0x0000000180308CA6
INFO: BLOCK ENABLES 0x5fffc
- ---
SLIC: Starting 89116 device and line initializion...
SLIC: Resetting device using GPIO 10 ...
SLIC: Reset applied on GPIO pin 10SLIC: Initializing 89116 device
0 SLIC: Received VP_DEV_EVID_DEV_INIT_CMP event (i = 0) SLIC:
Found event: pEvent.eventCategory = 2 pEvent.eventId = 1024 SLIC:
89116 device 0 initialized OK SLIC: Initializing 89116 FXS line
SLIC: Received VP_LINE_EVID_LINE_INIT_CMP event (i = 0) SLIC:
Found event: pEvent.eventCategory = 2 pEvent.eventId = 2048
ssk:error:49.984:initVodslBoundIpIfMultiWanSideUpLocked:594:Failed
to get WAN Connection object ssk:error:49.987:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:49.989:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:49.992:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:49.994:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:49.997:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:49.999:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:50.002:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:50.003:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:50.006:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:50.008:ssk_main:828:cannot
handle msg type 0x10002000 ssk:error:50.010:ssk_main:828:cannot
handle msg type 0x10002000
smd:error:50.036:oal_processEvents:841:detected exit of tr69c
(pid=2172) on fd 29 device wl0 left promiscuous mode br0: port
4(wl0) entering disabled state device wl0 is not a slave of br0
device wl0 entered promiscuous mode br0: port 4(wl0) entering
learning state br0: topology change detected, propagating br0:
port 4(wl0) entering forwarding state br0: port 4(wl0) entering
disabled state br0: port 3(eth2.0) entering disabled state br0:
port 2(eth1.0) entering disabled state br0: port 1(eth0.0)
entering disabled state br0: port 4(wl0) entering learning state
br0: port 3(eth2.0) entering learning state br0: port 2(eth1.0)
entering learning state br0: port 1(eth0.0) entering learning
state br0: topology change detected, propagating br0: port 4(wl0)
entering forwarding state br0: topology change detected,
propagating br0: port 3(eth2.0) entering forwarding state br0:
topology change detected, propagating br0: port 2(eth1.0)
entering forwarding state br0: topology change detected,
propagating br0: port 1(eth0.0) entering forwarding state device
wl0.1 is not a slave of br0 device wl0.2 is not a slave of br0
SLIC: Received VP_EVID_CAL_CMP event (i= 120) SLIC: Found event:
pEvent.eventCategory = 2 pEvent.eventId = 64 SLIC: FXS line RX
timeslot = 0 SLIC: FXS line TX timeslot = 0 SLIC: 89116 FXS line
initialized OK SLIC: 89116 device 0 and FXS/FXO initializion
COMPLETED OK !
- ---
- ---
SLIC: Starting 89116 device and line initializion...
SLIC: Skipping SLIC chip reset
SLIC: Initializing 89116 device 1
SLIC: Received VP_DEV_EVID_DEV_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 1024
SLIC: 89116 device 1 initialized OK SLIC: Initializing 89116 FXS
line SLIC: Received VP_LINE_EVID_LINE_INIT_CMP event (i = 0)
SLIC: Found event: pEvent.eventCategory = 2 pEvent.eventId = 2048
device wl0.3 is not a slave of br0 Reaped 3200
UPnP::upnp_init:UPnP daemon is ready to run SLIC: Received
VP_EVID_CAL_CMP event (i= 126) SLIC: Found event:
pEvent.eventCategory = 2 pEvent.eventId = 64 SLIC: FXS line RX
timeslot = 2 SLIC: FXS line TX timeslot = 2 SLIC: 89116 FXS line
initialized OK SLIC: 89116 device 1 and FXS/FXO initializion
COMPLETED OK !
- ---
boardHalInit completed
Enter TaskCreate HRTBEAT
TaskCreate - spawn new task HRTBEAT
Exit TaskCreate 
Enter TaskCreate VRGEVPR
TaskCreate - spawn new task VRGEVPR
Exit TaskCreate 
Enter TaskCreate HCAS
TaskCreate - spawn new task HCAS
Exit TaskCreate 
gInterruptCounter     = 0x811729A4 
gInterruptErrors      = 0x8115FEA0 
gNextRxDesc           = 0x8115FE94 
gNextTxDesc           = 0x8115FE90 
32 ms ECAN tail-length
*** gStartRxDesc[0] = 0xA02E7000 
*** gBufferSizeBytes = 640 
*** gStartTxDesc[0] = 0xA032D000 
hal6368PcmInit 343 nextTxDesc = 0xA032D000 
hal6368PcmInit 343 nextTxDesc = 0xA032D008 
hal6368PcmInit 347 Ownership for TX desc not set. Use this
buffer. DSP: Interrupt Masks
- ---------------
IrqMask_high               = 0x0000070D 
IrqMask                    = 0x002060B4 
IrqMask1_high              = 0x40000000 
IrqMask1                   = 0x00000000 
PCM_IUDMA->ctrl[0].intMask = 0x00000005 
PCM_IUDMA->ctrl[1].intMask = 0x00000005 

DSP: Interrupt Status
- -----------------
IrqStatus_high             = 0x00000000 
IrqStatus                  = 0x00000040 
IrqStatus1_high            = 0x00000000 
IrqStatus1                 = 0x00000040 
PCM_IUDMA->ctrl[0].intStat = 0x00000000 
PCM_IUDMA->ctrl[1].intStat = 0x00000000 
entering ksocket_rtp_init
Enter TaskCreate ksocket_rtp
TaskCreate - spawn new task ksocket_rtp
Exit TaskCreate 
Enter TaskCreate ksocket_rtcp
TaskCreate - spawn new task ksocket_rtcp
Exit TaskCreate 
EndpointInit completed
dgasp: kerSysRegisterDyingGaspHandler: endpoint registered
UPnP::upnp_request_handler:UPNP_CMD_DEV_DEL
UPnP::upnp_device_detach:br0: detach WFADevice.xml
EndpointEventTask, getpid = 3240 AppRegisterSignal, voiceApp pid
= 3240 00:00:54 Endpoint Event task started with pid 3240...

Send to PA successfully 
Enter TaskCreate voiceApp
TaskCreate - spawn new task voiceApp
voiceAppTask, getpid = 3241
AppRegisterSignal, voiceApp pid = 3241
voiceDspCoreChanClose, reset dsp pool and dsp channels
phonePortInit NumOfPhyIntf = 2, NumOfFxo = 0
Exit TaskCreate 
Send to PA successfully 
UPnP::upnp_request_handler:UPNP_CMD_DEV_ADD
UPnP::upnp_device_attach:br0: attach WFADevice.xml
==== autoProvStart Parameters====
AutoProvActive = 1
AutoProvServerUrl = ftp://xxxxxx:yyyyyy@bad.domain.here
AutoProvPeriodicInterval = 1440
AutoProvRetryInterval = 2
AutoProvRetryMaxInterval = 10
SoftwareVersion = 1.02(VFY.1)b6
autoProv:error:167.994:autoProvStart:624:2A027130657F,
auto-provision cmsGetMacAddress wget: bad.domain.here: Unknown host
autoProv:error:169.041:autoProvStart:651:autoProvStart, error,
empty file /var/2A027130657F.cfg

Importing wifi and the value of a CE mark

A while back I tried to buy a new wifi router.  I was sick of having to pay rental to my local ISP, now that we were on fibre and didn’t need any special DSL router.  I found a nice one online that ran OpenWrt, was a very nice price, and bought it.  Eventually, I got an email from local customs telling me in no uncertain terms that there was no way in hell I was having this device unless I could provide the CE documentation for it, and I could pay to have it destroyed, or get it sent back to the seller.   http://www.reglugerd.is/reglugerdir/allar/nr/90-2007 is the local regulation covering this, basically, “All wireless communications devices need to have a CE mark. If they don’t, they’re illegal in Iceland”

Ok, well and good.  I understand the general purpose.  Reading the actual law, it turns out there’s a massive pile of loopholes if you phrase it right, first and foremost, “this is for my boat” but ok, so be it.  The device got sent back, the seller refunded me, nothing lost but time.

I kept looking for a suitable router though, and got used to looking at all the available pictures and sending emails to china asking if the device had a CE mark.  I got a “yes” reply on one finally and bought it.  Now, the parcel arrived, with this neat sticker on it:

Bad goods

Bad goods

Now, turns out this just means that it’s foreign sourced, and should have tax applied, but I think it’s interesting that this was simply delivered to me, with no request for further information.

Especially as, when I finally opened it up, it didn’t have a CE mark anyway!  (Lying sellers? who woulda thunk it!)  Ah well.  Unevenly applied regulations, nothing new there :(

Icelandic post handling fees

I’m against being charged an arbitrary handling fee for receving a parcel. I’m fine with paying the customs + VAT charges, but I hate having to pay a flat fee for “handling” on top of that. But, if you’re doing it, it should at least be consistent. I got a parcel recently, and the invoice stuck on the outside of the parcel showed the split charge of VAT and handling properly.

Split fees for handling and customs

Split fees for handling and customs

You can see why I hate the flat fee here, it’s more than entire sum of VAT, resulting in an effective import tax of >50% instead of 25% (961 kr fees on a 1712 kr value parcel). It comes down far too heavily on small imports

However, the receipt I got from the post office after paying this has split it differently, claiming it was “free” to deliver it to me, and lumping all the rest into one line item.

"free" delivery, merged customs and handling fees

“free” delivery, merged customs and handling fees

This receipt is weird. Why would you have a line item for “delivery” being free, and then throw away the prior knowledge of this as two line items, and merge them into one? Silly post office.

Facebook share scraping image selector open graph woes

So, the share buttons on my website have been giving blank images, or the wrong images for a while. You’re meant to go and add a whole bunch of OpenGraph meta tags, but W.T.F the tag for the image to use must be absolute. wat

No, really, WAT. For double fun wat, it must include the protocol too! You have to use a second tag if you want to use https!

So, using the “modern” og:image tags is just right out then. (for realz, who the fuck though absolute urls were a good idea. I generate galleries, the galleries just run on disk, you don’t need to know where in the site they’re mounted or anything) Web browsers themselves are perfectly capable of loading a relative url image. Facebook’s Object Debugger on the other hand, not so much. It will take an img with src=../blah.jpg" and turn it into http://domain/blah.jpg, completely ignoring the path sections.

However… it can deal with relative urls that don’t have .. in them. “src=img/blah.jpg” is perfectly ok. Dumb, dumb and dumber.

<img src="../blah.jpg"> FAIL
<img src="blah.jpg"> GOOD
<img src="relative/blah.jpg"> GOOD

WAT

Archaeology in Sobell’s “Unix System V – A Practical Guide”

Clearing some boxes recently, and pulled up an old gem that I used to carry around university. Mark Sobell’s Unix System V – A Practical Guide A lot of it is still relevant today for linux and even OSX users, with basic guides to shells, redirections, awk, sed and vi. Some of it is however (predictably) dated. Chapter 7 has some lovely spots to dig for buried treasure.

finger

Does my current machine even have finger? hehe, wow, it does.

karlp@teros:~$ finger
Login     Name           Tty      Idle  Login Time   Office     Office Phone   Host
karlp     Karl Palsson  *:0             Sep  7 10:09                           (:0)
karlp     Karl Palsson   pts/0      23  Sep  7 10:09                           (:0)
karlp     Karl Palsson   pts/1      29  Sep  7 11:35                           (:0)
karlp     Karl Palsson   pts/2          Sep  7 11:35                           (:0)
karlp@teros:~$

Ok, cool, let’s try the example from the book!

karlp@teros:~$ finger quake@gldfs.cr.usgs.gov
finger: unknown host: gldfs.cr.usgs.gov
karlp@teros:~$ 

Oh well, somewhat predictable. No live earthquake list for me.

telnet services

We’ll skip over all the descriptions of FDDI, XNS, rlogin and hosts files, proceed straight to the library of congress information system.

karlp@teros:~$ telnet locis.loc.gov
telnet: locis.loc.gov: Name or service not known
locis.loc.gov: Unknown host
karlp@teros:~$

Or not.

archie and gopher

wow, archie, I’d forgotten about archie and gopher. can’t even try these, no archie in current fedora, and no package for it either :)

Oh well. it was fun to skim over the chapter again :)

Cypress CY8CKIT-059 PSoC 5LP proto kit – first impressions

Love the packaging! I got this CY8CKIT-059 PSoC 5LP proto kit, and the CY8CKIT-049-42xx, the PSoC 4 proto kit, as they’re both super cheap, and they both came in rather excellent packaging. The pcb is behind a peel off window, in a cutout of a sandwich of three sheets of corrugated cardboard. The backside has a nice graphical layout with pins labelled, and some basic info on where to get more info. Very nice, compact, easy to ship, well done Cypress.
cypress-kit-edge-on_sm

cypress-kit-backside_sm

cypress-kit-front_sm

Of course, that’s about all that’s nice. The PSoC family seems interesting, I’ve been wanting to play with them for a while, but Cypress has absolutely zero linux support, and because of the configurable nature of the device, you really do seem to need to use their windows PSoC Creator tool. Allegedly once you’ve designed your system, you can edit the code portions freely, but it seems a long way off. OpenOCD has support for the flash in the PSoC 4 family, but nothing (yet) for the flash, and definitely no support for the KitProg programming dongle. That KitProg does seem like a nice bit of gear in it’s own right though, it’s USB2I2C, USB2UART, SWD debug adapter, on a little snap off portion of the board. However, even the USB2UART portion fails to be recognised as CDC-ACM in linux, presumably due to a bug in the descriptors. lsusb implies that they’re trying to be CDC-ACM. This one will have to be on the shelf for quite a while I’d imagine.

Full lsusb output for posterity here:

Bus 003 Device 011: ID 04b4:f139 Cypress Semiconductor Corp. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0         8
  idVendor           0x04b4 Cypress Semiconductor Corp.
  idProduct          0xf139 
  bcdDevice            2.0b
  iManufacturer           1 Cypress Semiconductor
  iProduct                2 Cypress KitProg
  iSerial               128 1C210338012E4400
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          130
    bNumInterfaces          4
    bConfigurationValue     1
    iConfiguration          2 Cypress KitProg
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              400mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      0 No Subclass
      bInterfaceProtocol      0 None
      iInterface              3 KitBridge
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      43
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              5 KitProg Programmer
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       0 
      bFunctionProtocol       0 
      iFunction               0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      0 None
      iInterface              4 KitProg USBUART
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Union:
        bMasterInterface        2
        bSlaveInterface         1 
      CDC Call Management:
        bmCapabilities       0x00
        bDataInterface          1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               2
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0 
      iInterface              4 KitProg USBUART
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x07  EP 7 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
Device Status:     0x0000
  (Bus Powered)
$

The KitProg also has a bootloader of some form, if you hold down reset while plugging it in, though it times out and reboots normally after a couple of seconds idle.

Bus 003 Device 012: ID 04b4:f13b Cypress Semiconductor Corp. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x04b4 Cypress Semiconductor Corp.
  idProduct          0xf13b 
  bcdDevice            1.00
  iManufacturer           1 Cypress Semiconductor
  iProduct                4 KitProg Bootloader
  iSerial               128 1C210338012E4400
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           41
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          2 Configuration 0x0001
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      0 No Subclass
      bInterfaceProtocol      0 None
      iInterface              3 Interface 0x0001
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      36
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
Device Status:     0x0000
  (Bus Powered)

SiLabs EFM32 Happy Gecko starter kit – first impressions

More unboxing. It includes a CR2032 coin cell in the box. Handy when the product line’s premise is ultra low power. It includes two usb cables, one mini, one micro. What the hell. why are you using mixed connectors?! (One for debug, one for user, similar to the original STM32F4 discovery)

Nice looking board, nice screen. Factory demo software is space invaders! Nice demo of touch buttons, physical buttons and the screen. Startup screen shows the debugger state as well. Expansion header seems to have a full silkscreen with correct positioning. Debug connector for connecting your own debug hardware is the full ARM Cortex with trace header, 2×10@1.27mm pitch. This is somewhat unusual, I’ve never had one that broke out the full ETM pins.

The kit user guide implies that there’s a USB flash drive in the box, containing simplicity studio. Thankfully that’s not the case. That would have been really wasteful. (Yes, yes, helpful for some people with shitty internet, but incredibly wasteful for everyone else)

The onboard JLink OB also presents a mass storage device, with a (broken) mbed link, a link to the starter kit’s home page, and a link to simplicity studio’s homepage. Rather shitty filenames, but I guess that helped someone’s day :) Bit lame about the mbed link not working though. It looks like something that mbed setup to be permanent, but someone overlooked somewhere: http://mbed.org/device/?code=200501120000B7A4D74B847B (Update: It might actually work, but mbed’s website was hacked at the time of writing….)

The rest of the kit user guide doc is rather sparse, (to be polite) simply containing some screenshots of how to run demos and get more information from within Simplicity studio. The kit home page does have a link to download the schematics though, that’s nice.

Doesn’t work with OpenOCD at the time of writing, but very basic preliminary support is proposed in http://openocd.zylin.com/#/c/2931/

Atmel SAMD10 Xplained mini board review

Got a pile of dev boards for some testing. Some first impressions of the ATSAMD10-XMINI. First off, it’s nice and cheap, $9 or so. Comes in a really small cardboard box, with absolutely no documentation beyond some links on the box. Totally fine, no need for anything else these days. The board is a somewhat unusual shape, with the micro usb connector for the onboard DDBG (CMSIS-DAP) protruding out the back. Whatever. At first glace, the board appears well labelled. A closer glance….. well…

The user guide for this board refers to all the headers as JXXX. The J number is NOT in the silk on the board. The userguide has a picture of the board, and marks some of the J headers, but not all. The rest you have to just sort of figure out. This seems like a really amateur oversight. Fixing the silk would have been ideal, but at least the documentation could have a better overview of the board! (The userguide does manage to include screenshots of how to install atmel FLIP, which seems like a total waste of space for this document)

The user guide refers to the pins with J200-1, -2, -3, etc. The silk on the pad arrays is just numbered 1..5, and A..P. There’s silk on the back describing some pins, no idea why some and not others. There’s a big box of silk on the back that seems to be describing some pins, but no idea which, or what order.

There’s a specially boxed off section of pads in the top right, 2×10. It’s unlabeled. No idea what it’s for. (Update, turns out this is for Xplained Pro addons, the userguide covers this, and actually uses the grid array notation that matches the board.)

The user guide does (un)helpfully include arduino pin numbers, for the arduino compatible pin arrays, but there’s no mention of arduino software, or linked anywhere, so who cares about that. The column in the table that includes this is unlabeled as well.

The factory firmware is a morse application. Connecting to the CDC-ACM uart provided by the EDBG module lets you blink out letters, and tapping in keys on the user button prints them to the uart. It resets every few seconds idle and prints some help text. Neat enough.

The user guide does NOT include the schematic of the board. This is a serious omission. Particularly given the poor documentation/silk screen match up, but also as these boards are often used as examples for your own projects. A snippet of the power supply section is included, but again, the labels don’t match the board. I went back and forth through the user guide a few times to make sure I wasn’t missing anything. However, the software package download, which I skipped initially, actually includes no software. It includes all the schematics and proper board diagrams that should have been in the user guide. Pretty poor form Atmel :|

No comments on the tools or device itself yet, that’s for a much later date :)

Terminus Tech 7 port usb 2 “high speed” hub teardown

7 port usb 2.0 “high speed” hub, with per port power switches and leds. Only shows up as full speed in lsusb. Leds on ports are very bright, power switches only cut vbus line, rather flaky construction, shaking or bumping can cause disconnects. Seems to consume too much power, without external 5V (not included) vbus can be very low. Available on ebay, tmart, dx.com… http://www.ebay.com/itm/371304833792

The fe1.1s chips are meant to support high speed, so…?

Update: When I had it open, connected to a different computer, it showed up reliably as high speed. Back on the original computer, disassembled, still high speed. Case closed up again, it would show up normally as full speed fallback, and only occasionally as high speed. Further testing indicated that the front panel usb socket is the actual cause. Connecting this hub to another high speed hub showed up reliably as high speed.

The sexy input cap is 200uF, 10V. The rocker switches are KCD11, rated 3A 250VAC, or 6A, 125VAC! The crystal is umarked, but must be 12Mhz from the datasheet.

2015_06_17-14_30_42--img_9408_JFR

2015_06_17-14_30_37--img_9407_JFR

2015_06_17-14_30_00--img_9406_JFR

version control of tools – part 2

Oh look! again! Remember kids, it’s not just compilers that you should keep around, but libc/binutils, and all libraries you’re ever going to use.

Today it’s avr-libc, and this gem:

In file included from ../../common/FreqCounter.h:17:0,
                 from ../../common/FreqCounter.c:35:
/usr/avr/include/util/delay.h: In function '__vector_21':
/usr/avr/include/util/delay.h:246:2: error: __builtin_avr_delay_cycles expects a compile time integer constant
  __builtin_avr_delay_cycles(__ticks_dc);
  ^

Apparently it was always actually a requirement in the notes, but everyone did it anyway. Now, you need to write a wrapper function like this sort of shit:

void do_what_I_say_delay_us(int us) {
     while (us-- > 0) {
         _delay_us(1);
     }
}

Hooray, isn’t that better for everyone! See http://nongnu.org/avr-libc/user-manual/group__util__delay.html for more information, if you can read carefully enough :)